The File Menu

The File Menu, located in the top-left corner of the Wireshark window, provides options for managing capture files, saving and exporting data, and performing other file-related operations. Understanding the options within this menu is fundamental for handling your captured network traffic.

Common options found in the File Menu

• Open… (Ctrl+O / Cmd+O): Allows you to open previously saved capture files (in formats like .pcap, .pcapng, etc.). This is essential for analyzing traffic captured at an earlier time.
  • Wireshark supports a wide variety of capture file formats.
  • You can often filter the displayed files by format.
  • Wireshark remembers recently opened files for quick access.
• Close: Closes the currently open capture file, if any. If a capture is in progress, you will be prompted to stop and save it.
• Save As… (Ctrl+S / Cmd+S): Enables you to save the currently loaded or captured data to a file.
  • You can choose from various save file formats, with .pcapng being the recommended modern format due to its flexibility and ability to store metadata. .pcap is a more traditional format with broader compatibility with older tools.
  • You can choose to save all packets, only the displayed packets (after applying a display filter), or only the marked packets. This provides granular control over what data you persist.
• Export Packet Dissections…: Offers more advanced options for exporting packet data in different formats beyond just the raw capture.
  • Plain Text: Exports the packet details pane content in a human-readable text format. You can customize the level of detail to include.
  • CSV (Comma Separated Values): Exports a tabular representation of the selected packet information, suitable for importing into spreadsheets or databases. You can configure the fields to be included.
  • PDML (Packet Details Markup Language): Exports the packet dissection in an XML format, which can be useful for programmatic analysis of packet data.
  • PSML (Packet Summary Markup Language): Exports a summary of the packets in an XML format, similar to the Packet List Pane columns.
  • JSON (JavaScript Object Notation): Exports packet data in JSON format, a popular format for data interchange.
• Export Specified Packets…: Allows you to export a specific range or selection of packets.
  • You can specify the packet numbers you want to export.
  • You can choose the export format (same options as “Export Packet Dissections…”).
• Print… (Ctrl+P / Cmd+P): Enables you to print the captured packet data or the Wireshark window. You can configure the print settings to include different levels of detail.
• Merge…: Allows you to combine multiple capture files into a single file. This can be useful when traffic was captured in segments or across different interfaces.
• Import from Hex Dump…: Permits you to import packet data that is represented in a hexadecimal dump format. This is often used when analyzing data from other tools or sources.
• Recent Files: Displays a list of recently opened capture files for quick access.
• Quit (Ctrl+Q / Cmd+Q): Closes the Wireshark application. You will be prompted to save any unsaved captures.

Understanding the File Menu options is crucial for managing your captured network data effectively, from opening existing captures to saving your analysis results in various formats.